AMENDMENT 

COMPLETE LISTING OF THE CLAIMS 

This listing of claims will replace all prior versions, and listings of claims in the 
application. Applicants have submitted a new complete claim set showing marked up 
claims with insertions indicated by underlining and deletions indicated by strikeouts 
and/or double bracketing. 

Listing of Claims 
1-33. (Canceled) 

34. (Currently Amended) A dynamic email spam analysis and management system 
comprising: 

a database including a plurality of spam rules, each of the plurality of spam rules 
having attributes including a score; 

a spam analyzer operable to process a log file received from each of a plurality 
of [[a]] message switch es, each message switch processing an email against each of the 
plurality of spam rules thus determining if the processed email will be marked as spam, 
and for each match between the processed email and each of the plurality of spam 
rules, each message switch creating an entry in its log file corresponding to the 
processed email and the matching spam rule wherein each entry includes the score from 
each matching spam rule, the spam analyzer aB4 operable to update the attributes of at 
least one of the plurality of spam rules in the database , the updating including 
modifying the score of the at least one of the plurality of spam rules, the updating 
based on i nformat i on der i ved from statistics calculated from at least one of the log files^ 
wherein the spam analyzer is distinct from each of the plurality of message switches. 
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and wherein each of the plurality of message switches are software being executed on 
one of a plurality of mail servers : and 

a select rules file including one or more select rules from the database of the 
plurality of spam rules, each of the one or more select rules being included in the select 
rules file based on its attributes, the select rules file being replicated transm i tted to 
each of the message switches. 

35. (Currently Amended) The system of claim 34 wherein the spam analyzer 

processes [[the]] each log file to determine how many times each of the plurality of 
spam rules was hit and accordingly updates the attributes corresponding to the each of 
the plurality of spam rules. 

36. (Previously Presented) The system of claim 34 wherein the attributes 
corresponding to each of the plurality of spam rules are updated to indicate how many 
times each of the plurality of spam rules was false-positive-hit. 

37. (Previously Presented) The system of claim 34 wherein one or more other select 
rules of the plurality of spam rules are retired, each of the one or more other select rules 
being retired based on its attributes. 

38. (Previously Presented) The system of claim 37 wherein the one or more other 
select rules have not been hit within a predetermined amount of time. 

39. (Previously Presented) The system of claim 34 wherein the select rules file further 
includes one or more new rules. 
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40. (Previously Presented) The system of claim 34 wherein the spam analyzer 
calculates, based on information derived from the log file, how many times each of the 
plurality of spam rules was hit. 

41 . (Previously Presented) The system of claim 34 wherein the attributes of each of 
the plurality of spam rules are modified to indicate how many times each of the plurality 
of spam rules was false-positive-hit. 

42 . (Previously Presented) The system of claim 34 wherein the spam analyzer 
calculates, based on information derived from the log file, how many hits of each of the 
plurality of spam rules was determined to be for spam email messages and accordingly 
modifies the corresponding attributes of the each of the plurality of spam rules. 

43. (Previously Presented) The system of claim 34 wherein the spam analyzer 
calculates based on information derived from the log file, how many hits of each of the 
plurality of spam rules was determined to be for non-spam email messages and 
accordingly modifies the corresponding attributes of the each of the plurality of spam 
rules. 

44. (Previously Presented) The system of claim 34 wherein the score of one of the 
plurality of spam rules is modified manually. 
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45. (Currently Amended) A dynamic email spam analysis and management system 

comprising: 

a message switch including a spam filter operable to receive an email message 
wherein the message switch is one of a plurality of message switches that are each 
software being executed on one of a plurality of mail servers; and 

a select rules file including a plurality of spam rules , each of the plurality of spam 
rules having attributes including a score, usab l e by wherein the spam filter to ana l yze 
analyzes the email message [[and]] to determine if the email message will be marked as 
[[is a]] spam ema il message or a non spam ema i l message wherein the analyzing 
includes creating an entry in a log file, for the ema il message i n a l og f il e, the entry 
including spam i nformat i on correspond i ng the score from each of the plurality of spam 
rules that matches [[to]] the email message, and wherein the message switch 
periodically communicates the contents of the log file to a central server and 
periodically receives an updated select rules file from the central server, the updated 
select rules file differing from the select rules file, and the updated select rules file 
becoming the select rules file once received , and wherein the central server is distinct 
from each of the plurality of message switches . 

46. (Canceled) The system of c l a i m 45 where i n a score i s i nc l uded i n the se l ect ru l es 
f il e for each of the p l ura li ty of spam ru l es. 

47. (Currently Amended) The system of claim 45 [[46]] wherein a total spam score 
for [[of|] the email message is modified using the score of each of the plurality of spam 
rules message for which there is a hit on the email message. 



Amendment 
Application Number: 10/690,422 
Attorney Docket Number: 31 5547.01 



5 of 18 



AMENDMENT 



48. (Previously Presented) The system of claim 47 wherein, if the total spam score 
exceeds a score threshold, the email message is identified as a spam email message. 

49. (Currently Amended) The system of claim 45 wherein each of the plurality of 
spam rules has attributes including one or more of: a score, a date and time the spam 
rule was last updated, number of hits, number of spam hits, number of non-spam hits, 
and date and time of last hit. 

50. (Previously Presented) The system of claim 47 wherein, if the total spam score 
does not exceed a score threshold, the email message is identified as a non-spam email 
message. 

51 . (Previously Presented) The system of claim 50 wherein the email message is 
transferred to an intended recipient. 

52. (Previously Presented) The system of claim 45 wherein each of the plurality of 
spam rules are constructed using regular expressions. 
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53. (Currently Amended) A method for dynamically updating spam rules, the method 

comprising: 

receiving an email message at a message switch wherein the message switch is 
one of a plurality of message switches that are each software being executed on one of 
a plurality of mail servers; 

processing the email message against the spam rules to determine if the email 
message will be marked as [[is a]] spam ema il mcssagG. each of the spam rules having 
attributes including a score or a non spam ema il mGosagc ; 

creating a spam information entry correspond i ng to the ema il message in a log 
file, the spam information entry including the score from each of the spam rules that the 
processed email message matches : 

calculating statistics for the spam rules based on the spam information in the log 

file; 

updating a database of the spam rules based on the statistics , the updating 
including modifying the score of at least one of the spam rules ; 

selecting a set of select rules from the database of the updated spam rules to 
form a select rules set; and 

replicating the select rules set to the message switch wherein the select rules 
set, once received by the message switch, becomes the spam rules. 

54. (Canceled) The method of c l a i m 53 whoro i n the message sw i tch i s one of a 
p l ura li ty of message sw i tches each operat i ng on a server as part of a d i str i buted 

5 5 . (Canceled) The method of c l a i m 53 where i n each of the spam ru l es has a score. 
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56. (Previously Presented) The method of claim 55 wherein the processing includes 
testing the email message against each of the spam rules for a hit and, if a hit exists for 
the each of the spam rules, modifying a total spam score of the email message based on 
the score of the each of the spam rules. 

57. (Previously Presented) The method of claim 56 wherein the spam information 
entry corresponding to the email message in the log file includes an identifier for each 
of the spam rules for which there was a hit. 

58. (Previously Presented) The method of claim 53 wherein the calculating includes 
calculating, based on the log file, how many times each of the spam rules was hit. 

59. (Previously Presented) The method of claim 53 wherein the calculating includes 
calculating, based on the log file, how many hits for each of the spam rules were for a 
spam email message versus a non-spam email message. 

60. (Previously Presented) The method of claim 53 wherein the updating includes 
updating a quantity of false-positive-hits for one or more of the spam rules. 

61 . (Previously Presented) The method of claim 53 wherein the selecting includes 
retiring one or more of the spam rules wherein the retired spam rules are not included 
in the select rules set. 

62. (Previously Presented) The method of claim 55 wherein the updating includes 
updating the score of one or more of the spam rules based on the statistics. 
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63. (Previously Presented) The method of claim 55 wherein the score of each of the 
spam rules can be modified manually. 

64. (Currently Amended) The method of claim 53 [[54]] wherein the replicating 
includes replicating the select rules set to each of the plurality of message switches. 

65. (Previously Presented) The method of claim 53 further comprising, if the email 
message is determined to be a non-spam email message, transferring the email 
message to an intended recipient. 

66. (Previously Presented) The method of claim 53 embodied as computer- 
executable instructions stored on a computer-readable medium. 
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